CVE-2024-3016

NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user...

CVE-2024-3016

NEC Platforms DT900 and DT900S Series 5.0.0.0 – v5.3.4.4, v5.4.0.0 – v5.6.0.20 allows an attacker to access a non-documented the system settings to change settings via local network with unauthenticated user...

CVE-2024-3016

CVE-2024-3016 affects NEC Platforms DT900/DT900S Series. Affects firmware ranges 5.0.0.0–5.3.4.4 and 5.4.0.0–5.6.0.20. The issue lets an unauthenticated attacker access non-documented system settings via the local network and change settings. Public documents corroborate: Red Hat and JVNDB entrie...

PT-2024-23215 · Nec · Dt900 +1

Name of the Vulnerable Software and Affected Versions: NEC Platforms DT900 and DT900S Series versions 5.0.0.0 through 5.3.4.4 NEC Platforms DT900 and DT900S Series versions 5.4.0.0 through 5.6.0.20 Description: The issue allows an attacker to access non-documented system settings and change them...

Oracle Linux 9 : pcp (ELSA-2024-2566)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2566 advisory. 6.2.0-2.0.1 - Fixed libpcp derived metric issue for ol9 Orabug: 36538820 6.2.0-2 - Disable RESP proxying by default in pmproxy RHEL-30719 Tenable has extracted...

CVE-2024-3661 DHCP routing options can manipulate interface-based VPN traffic

DHCP can add routes to a client’s routing table via the classless static route option 121. VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify...

CVE-2024-3661 DHCP routing options can manipulate interface-based VPN traffic

DHCP can add routes to a client’s routing table via the classless static route option 121. VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network can read, disrupt, or possibly modify...

DHCP 安全漏洞

DHCP is a network infrastructure protocol. A security vulnerability exists in DHCP that stems from the ability to add routes to a client's routing table via the static routing option, where an attacker on the same local network can read, corrupt, or modify VPN-protected network traffic...

PT-2024-25767 · Wasm3 · Wasm3

Name of the Vulnerable Software and Affected Versions: wasm3 version 0.5.0 Description: A heap buffer overflow was discovered in wasm3, leading to a segmentation fault via the DeallocateSlot function in m3 compile.c. This issue requires local network access to exploit. Recommendations: Update to ...

CVE-2024-34068

Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. Thi...

Wings 代码问题漏洞

Wings is the server control interface for Pterodactyl Panel. A security vulnerability exists in versions of Wings prior to 1.11.12, which arises from the ability of a user with privileged access to the game server to bypass previously implemented access controls, allowing an attacker to access...

PT-2024-25506 · Parrot · Parrot Anafi Usa

Name of the Vulnerable Software and Affected Versions: Parrot ANAFI USA firmware version 1.10.4 Description: The issue concerns a lack of validation for the MAV MISSION TYPE in the Parrot ANAFI USA firmware, specifically for values 0, 1, 2, and 255. This allows an attacker to disrupt the connecti...

tcpslice: use-after-free in extract_slice()

A heap use-after-free flaw was found in tcpslices' extractslice. This flaw allows an attacker with local network access to pass a specially crafted 'pcap' file to tcpslice, causing segmentation fault. This vulnerability halts or crashes the application, leading to a denial of service...

OESA-2024-1495 pcp security update

PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems. Security Fixes: A flaw was found in PCP. The default pmproxy configuration expose...

CVE-2024-31991 Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)

Mealie is a self hosted recipe manager and meal planner. Prior to 1.4.0, the safescrapehtml function utilizes a user-controlled URL to issue a request to a remote server. Based on the content of the response, it will either parse the content or disregard it. This function, nor those that call it,...

CVE-2024-31991

Mealie (self-hosted recipe manager) prior to version 1.4.0 is affected by an SSRF in the safe_scrape_html function, which takes a user-controlled URL and makes a remote request without URL restrictions. This can allow an authenticated user to identify HTTP(S) servers on the local network that Mea...

PT-2024-24341 · Mealie · Mealie

Name of the Vulnerable Software and Affected Versions: Mealie versions prior to 1.4.0 Description: The issue concerns the safe scrape html function, which uses a user-controlled URL to issue a request to a remote server. This function does not restrict the URL that can be provided, allowing an...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner from an individual developer in Hayden, USA. A security vulnerability exists in Mealie versions prior to 1.4.0, which stems from a safescrapehtml function that utilizes a user-controlled URL to make a request to a remote server, which can be...

DEBIAN-CVE-2024-32473

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where --ipv6=false. An container with an ipvl...

OESA-2024-1436 pcp security update

PCP provides a range of services that may be used to monitor and manage system performance. These services are distributed and scalable to accommodate the most complex system configurations and performance problems. Security Fixes: A flaw was found in PCP. The default pmproxy configuration expose...